I am working on a tool that makes use of the Tooling API and the Partner API. The Partner API is used to login as I have been unable to login successfully via the Tooling API. Another important thing to note is that this tool is being built in Java. What I noticed was that whether I attempt to login via the Connector.newConnection() method with a ConnectorConfig object or call login() on an instance of the PartnerConnection class, it uses a String object instead of a char[] for both the password and the security token. This would end up with the user's password and security token combination being stored in the JVM's String pool and would pose a security risk. Is there a way to login with a char[] or a byte[] for the password and the security token instead of a String?
string
vschar[]
in Why is char[] preferred over String for passwords?. Personally, I'm of the school that if your machine has been so badly compromised that someone is tampering with your memory then you have much bigger problems.char[]
and then clear it immediately to reduce the window that someone else might read it.